Remove unfinished rollback command

[joerucci]

Summary

• Remove the hidden ghostable var rollback stub that only returned a not-implemented error.
• Add regression coverage confirming rollback is outside the supported variable command surface.
• Keep repository-state recovery delegated to Git instead of implying a partially implemented CLI feature.

Why

The rollback branch was the only production-facing placeholder found during the release-readiness audit. It was absent from help and documentation but still accepted as a special command, which made the CLI appear partially implemented.

Impact

There is no change to the documented command surface. Unsupported rollback requests now receive the same unknown-command behavior as other unsupported variable operations. Repository-backed state can be recovered through Git; externally deployed values still require redeploying the reverted state.

Validation

• make check
• make security-check
• go test -race ./...
• Clean local build and diff checks